Skip to content Skip to navigation

OIG Report: CMS Not Perfect with Breach Notification Rules

October 12, 2012
by Gabriel Perna
| Reprints

According to a recent audit by the Department of Health & Human Services' Office of the Inspector General (OIG), the Centers for Medicare and Medicaid Services (CMS) could improve the database in which it lists all of the breaches of protected health information is has had since 2009. Also, while CMS did notify 13,775 Medicare beneficiaries affected by the breaches, it did not meet several American Recovery and Reinvestment Act (ARRA) requirements.

The study, from OIG, looked at how effective CMS has been in notifying the affected Medicare beneficiaries when their protected health information has been breached, as required by the ARRA. The audit looked to determine the extent to which CMS’ response met the notification requirements in the ARRA by looking at its response to medical identity theft involving beneficiary and provider Medicare identification numbers and the remedies it offers to beneficiaries and providers.

The audit found that between Sept. 23, 2009 and Dec. 31, 2011, CMS reported 14 breaches. While it did make progress in responding to medical identity theft by developing a compromised number database for contractors, it failed on several requirements. Along with the database, it did not consistently develop edits to stop payments on compromised numbers. Also, the audit’s authors say CMS offers some remedies to providers but fewer to beneficiaries affected by medical identity theft.

For its recommendations, OIG recommended CMS ensure that breach notifications meet Recovery Act requirements, improve the compromised number database, and provide guidance to contractors about using database information and implementing edits. It also recommended CMS develop a method for ensuring that beneficiaries who are victims of medical identity theft retain access to needed services and one for reissuing identification numbers to beneficiaries affected by medical identity theft.



Healthcare Industry Organizations Collaborating to Improve Integration between CPT codes and SNOMED CT

The American Medical Association and the International Health Terminology Standards Development Organisation are working together, through a collaborative agreement, to create better integration between their proprietary code sets in support of interoperability and healthcare data analytics.

Vocera to Acquire Extension Healthcare for $55M

Vocera Communications, the San Jose, Calif.-based healthcare communications company, has announced that it has acquired Extension Healthcare for approximately $55 million in an all-cash transaction.

Reports: Issues Arise in 21st Century Cures Act; Delay Possible

The 21st Century Cures Act could be in danger of not passing this year following a statement from a coalition of liberal groups calling into question the bill’s ability to address high drug prices.

ONC National Coordinator Gets Live Look at Carequality Data Exchange

Officials from Carequality have stated that there are now more than 150,000 clinicians across 11,000 clinics and 500 hospitals live on its network. These participants are also able to share health data records with one another, regardless of technology vendor.

American Red Cross, Teladoc to Provide Telehealth Services to Disaster Victims

The American Red Cross announced a partnership with Teladoc to deliver remote medical care to communities in the United States that are significantly affected by disasters.

Report: The Business of Cybercrime in Healthcare is Growing

While stolen financial data still has a higher market value than stolen medical records, as financial data can be monetized faster, there are indications that there is ongoing development of a market for stolen medical data, according to an Intel Security McAfee Labs report.